Executive brief
A vulnerability in the Linux kernel's filesystem management could allow a local user to interfere with system stability. By manipulating mount settings that should be restricted to other parts of the system, an attacker could potentially cause a denial-of-service condition. This issue affects how the system handles shared folders and disk drives across different isolated environments (namespaces).
Technical details
A vulnerability was identified in the do_change_type() function within fs/namespace.c of the Linux kernel. The function failed to verify if a mount belonged to the caller's mount namespace before allowing changes to its propagation settings (e.g., MS_SHARED). By invoking mount(2) on unmounted or foreign mounts, a local attacker with standard privileges could bypass intended namespace isolation. This could lead to a denial-of-service (DoS) by corrupting mount states or exhausting resources. The fix introduces a check_mnt() call to ensure the mount is valid and owned by the caller's namespace before proceeding with type changes.
Affected products
- Linux Linux Kernel 2.6.15 to 5.4.295, 5.5 to 5.10.239, 5.11 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, 6.13 to 6.15.3
Timeline
- 2025-07-30: disclosed
- 2025-07-30: advisory
- 2025-06-07: patched: Initial patch commit in Linux stable tree
References
- https://git.kernel.org/stable/c/064014f7812744451d5d0592f3d2bcd727f2ee93
- https://git.kernel.org/stable/c/12f147ddd6de7382dad54812e65f3f08d05809fc
- https://git.kernel.org/stable/c/19554c79a2095ddde850906a067915c1ef3a4114
- https://git.kernel.org/stable/c/432a171d60056489270c462e651e6c3a13f855b1
- https://git.kernel.org/stable/c/4f091ad0862b02dc42a19a120b7048de848561f8
- https://git.kernel.org/stable/c/787937c4e373f1722c4343e5a5a4eb0f8543e589
- https://git.kernel.org/stable/c/9c1ddfeb662b668fff69c5f1cfdd9f5d23d55d23